I want to migrate the old freeipa LDAP server to a new Freeipa server. However, after
using this migration scheme, I find that the old keytab file cannot be logged in. How do I
set up the old keytab file to work properly?
https://www.freeipa.org/page/Howto/Migration
echo Secret123 | ipa migrate-ds --bind-dn="cn=Directory Manager"
--user-container=cn=users,cn=accounts --group-container=cn=groups,cn=accounts
--group-objectclass=posixgroup
--user-ignore-attribute={krbPrincipalName,krbextradata,krblastfailedauth,krblastpwdchange,krblastsuccessfulauth,krbloginfailedcount,krbpasswordexpiration,krbticketflags,krbpwdpolicyreference,mepManagedEntry}
--user-ignore-objectclass=mepOriginEntry --with-compat
ldap://migrated.freeipa.server.test
ssh new.migrated.freeipa.server.test
Use the old keytab file
root@migration-ipa-65:/home/liangrui# kinit -kt roy.keytab roy
kinit: Generic preauthentication failure while getting initial credentials